Privacy Policy
Last updated 13 August 2026
This describes the app as it actually works, field by field, not as a template. If something here does not match what TrainFloor does, the policy is wrong and we want to hear about it.
The short version
- There is no analytics SDK, no advertising, no location tracking and no payments.
- What we hold is your account, your profile, what you post, what you train and who you follow.
- Text you post is checked by an automated model before it appears. That text leaves our systems.
- You can delete everything from inside the app, immediately.
- Nothing is sold, and nothing goes to advertisers or data brokers.
What TrainFloor collects
Your account
An email address, which you type or which Apple or Google returns when you sign in with them. If you use Sign in with Apple and choose to hide your address, TrainFloor receives Apple's private relay address and never sees your real one. Passwords are handled by our authentication provider and are never visible to us.
Your profile
A handle and a display name, which are required. Everything else is optional: a biography, a location, years of training experience, gender, an avatar, a cover image, and links to your accounts elsewhere. Location is a free-text field you type, such as a city. TrainFloor never requests or receives GPS or device location.
What you post
Workouts and the equipment and body parts tagged on them. Images, YouTube links, and voice notes, which are stored with their length and a waveform of their loudness so the app can draw the bars. Comments, replies, reactions, and direct messages.
What you train
Records of workouts you have started and how long you spent on them, and any result you post to a leaderboard: time, rounds, reps, weight, the unit, and whether it was as prescribed.
Who you follow
Accounts you follow, block or save, so the app can show them back to you.
Your settings
Notification preferences, and the switches that control whether your account is private, whether you appear on leaderboards, whether your reaction counts are hidden, and who may message, comment or post scores.
Your device, only for notifications
If you turn on push notifications, TrainFloor stores a push token and your platform, iOS or Android, so a notification can reach the right device. Turning notifications off removes it.
Safety
Reports you file about other people or their content, including what you reported, the reason, any detail you wrote, and how it was resolved. These are kept after resolution so a pattern of behaviour can be recognised.
What TrainFloor does not collect
- No analytics or tracking SDK of any kind. There is none in the app.
- No advertising identifiers, and no advertising.
- No GPS or device location.
- No health or fitness data from Apple Health or Google Fit.
- No contacts, calendar, or photo library access beyond the single image you pick when you choose one.
- No payment information. TrainFloor takes no payments.
- No biometric identifiers or biometric information, as those terms are defined by the Illinois Biometric Information Privacy Act. A voice note is stored and played back as a recording. It is never analysed to identify, verify or distinguish the person speaking, and no voiceprint is derived from it. The waveform stored beside it is loudness over time, drawn as bars, and carries nothing about the voice itself.
The app asks for two device permissions and no others: the microphone, when you record a voice note, and notifications, if you turn them on. Both are refusable and the app works without either.
Why we hold each of these
| What | Why | Legal basis under GDPR |
|---|---|---|
| Email and password | To create your account and let you sign back in | Performance of a contract |
| Profile and posts | To show them to other people, which is what the app is for | Performance of a contract |
| Training records and results | To draw your history and leaderboards | Performance of a contract |
| Push token | To deliver a notification you asked for | Consent, withdrawn by turning notifications off |
| Automated review of posted text | To keep the app free of abuse and illegal content | Legitimate interests, and our obligations to app stores |
| Reports | To act on abuse and recognise repeat behaviour | Legitimate interests |
Automated review of what you post
When you post a workout, its text is sent to a language model operated by Moonshot AI so it can be classified and checked for spam, abuse and unsafe content. Comments and messages may be reviewed the same way. This means text you post leaves our systems and is processed by a company outside the EU and the United Kingdom. It is used to make that decision and for nothing else. Your profile details are not sent with it, and the model is not trained on your content by us.
This is an automated decision that can cause a post to be held or rejected. It does not have a legal or similarly significant effect on you, and a person reviews anything you dispute. Write to us and we will look at it.
Who else processes your data
| Who | What they handle | Where |
|---|---|---|
| Supabase | Sign-in, the database, and stored images and voice notes | United States |
| Hetzner | The server that receives a posted workout and runs the review | Germany |
| Moonshot AI | Automated review of posted text | Outside the EU and UK |
| Apple, Google | Sign-in only, if you choose those buttons | United States |
| Cloudflare | This website, the domain, and email to our published addresses | United States |
These are processors acting on our instructions. Your data is not sold, not rented, and not shared with advertisers or data brokers. We disclose data to law enforcement only where we are legally required to, or where somebody is in immediate danger.
Where your data goes
TrainFloor is operated from the United States and its database is hosted there. If you use the app from the European Economic Area or the United Kingdom, your data is transferred out of it. Those transfers rely on the Standard Contractual Clauses in our agreements with the processors named above.
What other people can see
Your handle, name, biography, location, experience, gender if you set it, avatar, cover image, links and posted workouts are visible to anybody signed in to TrainFloor. Comments and reactions are public on the thing they belong to. Leaderboard placements are public unless you turn them off. Direct messages are visible only to you and the person you sent them to.
Marking your account private limits who sees your profile. Blocking somebody stops them contacting you and hides their content from you.
How long it is kept
| What | How long |
|---|---|
| Your account and everything attached to it | Until you delete it |
| Direct messages | Until either side's account is deleted |
| Reports you filed | Kept after resolution, so repeat behaviour is visible |
| Database backups | Taken nightly, retained for a short period, then overwritten |
Deleting your account
You can delete your account from inside the app, in Settings. It removes your sign-in record, your profile and the content attached to it. Deletion is immediate and cannot be undone. Copies already written to a backup disappear when that backup is overwritten.
If you would rather we did it, or you want a copy of your data first, write to [email protected].
Your rights
You can see and change your profile in the app at any time, and delete your account. Depending on where you live you also have the right to:
- ask for a copy of the data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how it is used;
- receive your data in a portable form;
- withdraw consent you have given, without affecting what was done before you withdrew it;
- complain to a data protection authority, or in the United Kingdom the Information Commissioner's Office.
To exercise any of these, write to [email protected]. We answer within 30 days. We will not treat you differently for asking.
If you are in California: we do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. We do not knowingly sell the personal information of anybody under 16.
Cookies
The app uses no cookies. This website sets none, and carries no analytics and no trackers.
Children
TrainFloor is not for children under 13, and we do not knowingly collect anything from them. Where local law sets a higher age for consent to data processing, that age applies instead. If you believe a child has an account, write to us and it will be removed.
Security
Data is encrypted in transit. Access to the database is restricted per account by row-level security, so one account cannot read another's private data. The credential that can bypass those rules is held only on our server and never ships inside the app. No system is perfectly secure; if a breach occurs that puts your data at risk we will tell you and the relevant authority.
Changes
If this policy changes materially, the date at the top changes and the app will point you here. Continuing to use TrainFloor after a change means the new version applies.